Find the security holes in your vibe-coded app before your users do.
Ship-Safe is a Claude Code plugin. It tests your app the way an attacker would, only on your machine or a dev server you name, and shows you how to fix what it finds.
Demo
Three scenes, about 30 seconds. Use the tabs or arrow keys.
localhost:3000/notes/42Q3 invoices
Private note · only User A
Acme Co. owes $12,400. Due Oct 30.
localhost:3000/notes/41Launch checklist
Private note · only User B
Buy domain. Write the post.
Q3 invoices
Owner: User A
Acme Co. owes $12,400. Due Oct 30.
User B can read user A's notes.
HighConfirmed by a real request. GET /notes/42 as B → 200
Fix: only return a note if it belongs to the signed-in user.
› Testing: can user B open user A's note? checking target before sending…→ GET https://myapp.com/notes/42✕ Ship-Safe guard: https://myapp.com is not a registered target. Blocked. Nothing was sent.→ GET http://localhost:3000/notes/42✓ Allowed: registered dev target.
Where Ship-Safe may send requests
localhost:3000AllowedRegistered as dev by you
myapp.comBlockedNot registered. Treated as production.
Only addresses you confirm as dev get added.
const note = await getNote(id)+if (note.ownerId !== user.id) {+ return new Response("Forbidden",+ { status: 403 })+} return Response.json(note)
The note must belong to whoever is asking.
localhost:3000/notes/42Q3 invoices
Owner: User A
403 Forbidden
A's note stays private.
User B can read user A's notes.
OpenFixedWaiting for the second check.
Checked again with the same request. GET /notes/42 as B → 403
A stranger reads another user's note
Two test accounts, A and B, are signed in to your app on your own computer.
Simulated demo. Real recordings will replace it before launch.
Join the waitlistStatus and price
In development.
The first 100 buyers pay $19 instead of $29.
People on the waitlist get the 25-point Ship-Safe checklist by email this week.
Five beta spots cost nothing, for Next.js and Supabase apps.
Join the waitlist.
What Ship-Safe does
- Before a runReads your project and lists the addresses it may test. Anything you haven't confirmed as dev stays off the list.
- ReviewFive reviewers check login and permissions, secrets, database rules, inputs and outbound requests, and money and abuse.
- Real requestsA second test account tries to open the first account's data with real requests.
- FindingsEach finding says how it was found: confirmed by a real request, or found by reading code.
- After a fixAfter you fix something, it checks again with the same request.
Built by a former blue-team engineer with ten years on security teams.
What Ship-Safe is not
Ship-Safe is not an audit, a penetration test or a certification. It refuses to send requests to anything except localhost or a dev URL you register, and it shows you the plan before every run. Your code stays on your machine, and every check is a text file you can read first.
Get in touch
Questions go to hello@quelris.dev.